Indian-origin scientist hacks into Samsung's IoT platform

An Indian-origin cybersecurity researcher from University of Michigan and his team have successfully hacked into a leading "smart home" automation system and got the PIN code to a home's front door.IANS | May 04, 2016, 08:24 IST

NEW YORK: An Indian-origin cybersecurity researcher from University of Michigan and his team have successfully hacked into a leading "smart home" automation system and got the PIN code to a home's front door.

The "lock-pick malware app" developed by Atul Prakash, proNEW YORK: An Indian-origin cybersecurity researcher from University of Michigan and his team have successfully hacked into a leading "smart home" automation system and got the PIN code to a home's front door.

The "lock-pick malware app" developed by Atul Prakash, professor of computer science and engineering, was one of four attacks that the cybersecurity researchers performed at an experimental set-up of Samsung's "SmartThings", a top-selling Internet of Things (IoT) platform for consumers.

The work is believed to be the first platform-wide study of a real-world connected home system. "At least today, with the one public IoT software platform we looked at, which has been around for several years, there are significant design vulnerabilities from a security perspective," said Prakash. "I would say it's okay to use as a hobby right now but I wouldn't use it where security is paramount," he added. As a testament to the growing use of "SmartThings", its Android companion app that lets you manage your connected home devices remotely has been downloaded more than 100,000 times.

SmartThings' app store, where third-party developers can contribute SmartApps that run in the platform's cloud and let users customise functions, holds more than 500 apps.

Prakash and Earlence Fernandes, doctoral student in computer science and engineering performed a security analysis of the SmartThings' programming framework. They demonstrated a SmartApp that eavesdropped on someone setting a new PIN code for a door lock and then sent that PIN in a text message to a potential hacker.

The SmartApp, which they called a "lock-pick malware app", was disguised as a battery level monitor and only expressed the need for that capability in its code. As an example, they showed that an existing, highly rated SmartApp could be remotely exploited to virtually make a spare door key by programming an additional PIN into the electronic lock.

They showed that SmartApp could turn off "vacation mode" in a separate app that lets you programme the timing of lights, blinds, etc., while you're away to help secure the home.

They demonstrated that a fire alarm could be made to go off by any SmartApp injecting false messages. "The access SmartThings grants by default is at a full device level, rather than any narrower," Prakash said.

"As an analogy, say you give someone permission to change the lightbulb in your office, but the person also ends up getting access to your entire office, including the contents of your filing cabinets," he explained.

These results have implications for all smart home systems and even the broader Internet of Things (IoT).

fessor of computer science and engineering, was one of four attacks that the cybersecurity researchers performed at an experimental set-up of Samsung's "SmartThings", a top-selling Internet of Things (IoT) platform for consumers.

The work is believed to be the first platform-wide study of a real-world connected home system. "At least today, with the one public IoT software platform we looked at, which has been around for several years, there are significant design vulnerabilities from a security perspective," said Prakash."I would say it's okay to use as a hobby right now but I wouldn't use it where security is paramount," he added.

As a testament to the growing use of "SmartThings", its Android companion app that lets you manage your connected home devices remotely has been downloaded more than 100,000 times.

SmartThings' app store, where third-party developers can contribute SmartApps that run in the platform's cloud and let users customise functions, holds more than 500 apps.

Prakash and Earlence Fernandes, doctoral student in computer science and engineering performed a security analysis of the SmartThings' programming framework. They demonstrated a SmartApp that eavesdropped on someone setting a new PIN code for a door lock and then sent that PIN in a text message to a potential hacker.

The SmartApp, which they called a "lock-pick malware app", was disguised as a battery level monitor and only expressed the need for that capability in its code. As an example, they showed that an existing, highly rated SmartApp could be remotely exploited to virtually make a spare door key by programming an additional PIN into the electronic lock.

They showed that SmartApp could turn off "vacation mode" in a separate app that lets you programme the timing of lights, blinds, etc., while you're away to help secure the home.

They demonstrated that a fire alarm could be made to go off by any SmartApp injecting false messages. "The access SmartThings grants by default is at a full device level, rather than any narrower," Prakash said.

"As an analogy, say you give someone permission to change the lightbulb in your office, but the person also ends up getting access to your entire office, including the contents of your filing cabinets," he explained.

These results have implications for all smart home systems and even the broader Internet of Things (IoT).

Sponsored Stories

Subscribe ETCIO Newsletter

“Our recent partnership with Microsoft to enable an AI enabled tool to give a heart risk score intends to give the power of intelligent computing into the hands of a clinician,” writes Apollo Hospitals CIO Arvind Sivaramakrishnan

As the Special Chief Secretary & IT Advisor to the Chief Minister - Govt. of Andhra Pradesh, J A Chowdary is all for chasing new growth horizons, pursuing radically different development approaches and outguessing technology trends that will shape the future.